cs.xiht.plus
Open in
urlscan Pro
160.20.59.33
Malicious Activity!
Public Scan
Submitted URL: https://cs.xiht.plus/line/#/
Effective URL: https://cs.xiht.plus/line/
Submission Tags: 7372433
Submission: On December 03 via api from US — Scanned from JP
Effective URL: https://cs.xiht.plus/line/
Submission Tags: 7372433
Submission: On December 03 via api from US — Scanned from JP
Summary
This website contacted 2 IPs
in 1 countries
across 1 domains to perform 11 HTTP transactions.
The main IP is 160.20.59.33, located in
Hong Kong and
belongs to HKKFGL-AS-AP HK Kwaifong Group Limited, HK.
The main domain is cs.xiht.plus.
TLS certificate: Issued by TrustAsia TLS RSA CA on October 26th 2021. Valid for: a year.
This is the only time cs.xiht.plus was scanned on urlscan.io!
TLS certificate: Issued by TrustAsia TLS RSA CA on October 26th 2021. Valid for: a year.
This is the only time cs.xiht.plus was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Line (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 160.20.59.33 160.20.59.33 | 133115 (HKKFGL-AS...) (HKKFGL-AS-AP HK Kwaifong Group Limited) | |
| 11 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
xiht.plus
cs.xiht.plus |
218 KB |
| 11 | 1 |
| Domain | Requested by | |
|---|---|---|
| 11 | cs.xiht.plus |
cs.xiht.plus
|
| 11 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| terms.line.me |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| account-line.top TrustAsia TLS RSA CA |
2021-10-26 - 2022-10-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://cs.xiht.plus/line/
Frame ID: 8D063AFF84F42C75013ABF94EFF41F3A
Requests: 12 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
URL: https://terms.line.me/line_rules/?lang=ja
Title: プライバシーポリシー
Title: プライバシーポリシー
Search URL Search Domain Scan URL
URL: https://terms.line.me/line_terms/?lang=ja
Title: 利用規約
Title: 利用規約
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
cs.xiht.plus/line/ |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
torimochi.js
cs.xiht.plus/line/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
messages
cs.xiht.plus/line/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
chunk-common.css
cs.xiht.plus/line/css/ |
50 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
chunk-common.js
cs.xiht.plus/line/js/ |
99 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
chunk-vendors.js
cs.xiht.plus/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index.css
cs.xiht.plus/line/css/ |
1 KB 587 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
index.js
cs.xiht.plus/line/js/ |
42 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
translateelement.css
cs.xiht.plus/line/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lc_common.js
cs.xiht.plus/line/js/ |
28 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
chunk-vendors.js
cs.xiht.plus/line/js/ |
370 KB 142 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Line (Online)161 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| toVaild function| BigInteger function| nbi function| am1 function| am2 function| am3 function| int2char function| intAt function| bnpCopyTo function| bnpFromInt function| nbv function| bnpFromString function| bnpClamp function| bnToString function| bnNegate function| bnAbs function| bnCompareTo function| nbits function| bnBitLength function| bnpDLShiftTo function| bnpDRShiftTo function| bnpLShiftTo function| bnpRShiftTo function| bnpSubTo function| bnpMultiplyTo function| bnpSquareTo function| bnpDivRemTo function| bnMod function| Classic function| cConvert function| cRevert function| cReduce function| cMulTo function| cSqrTo function| bnpInvDigit function| Montgomery function| montConvert function| montRevert function| montReduce function| montSqrTo function| montMulTo function| bnpIsEven function| bnpExp function| bnModPowInt function| bnClone function| bnIntValue function| bnByteValue function| bnShortValue function| bnpChunkSize function| bnSigNum function| bnpToRadix function| bnpFromRadix function| bnpFromNumber function| bnToByteArray function| bnEquals function| bnMin function| bnMax function| bnpBitwiseTo function| op_and function| bnAnd function| op_or function| bnOr function| op_xor function| bnXor function| op_andnot function| bnAndNot function| bnNot function| bnShiftLeft function| bnShiftRight function| lbit function| bnGetLowestSetBit function| cbit function| bnBitCount function| bnTestBit function| bnpChangeBit function| bnSetBit function| bnClearBit function| bnFlipBit function| bnpAddTo function| bnAdd function| bnSubtract function| bnMultiply function| bnDivide function| bnRemainder function| bnDivideAndRemainder function| bnpDMultiply function| bnpDAddOffset function| NullExp function| nNop function| nMulTo function| nSqrTo function| bnPow function| bnpMultiplyLowerTo function| bnpMultiplyUpperTo function| Barrett function| barrettConvert function| barrettRevert function| barrettReduce function| barrettSqrTo function| barrettMulTo function| bnModPow function| bnGCD function| bnpModInt function| bnModInverse function| bnIsProbablePrime function| bnpMillerRabin function| Arcfour function| ARC4init function| ARC4next function| prng_newstate function| rng_seed_int function| rng_seed_time function| rng_get_byte function| rng_get_bytes function| SecureRandom function| parseBigInt function| linebrk function| byte2Hex function| pkcs1pad2 function| RSAKey function| RSASetPublic function| RSADoPublic function| RSAEncrypt function| RSAEncryptB64 function| pkcs1unpad2 function| RSASetPrivate function| RSASetPrivateEx function| RSAGenerate function| RSADoPrivate function| RSADecrypt object| lc object| nj number| dbits number| canary boolean| j_lm number| BI_FP string| BI_RM object| BI_RC number| rr number| vv object| lowprimes number| lplim number| rng_psize undefined| rng_state object| rng_pool number| rng_pptr number| t undefined| z object| Base64 object| jQuery object| webpackJsonp object| core object| __core-js_shared__ function| setImmediate function| clearImmediate object| regeneratorRuntime string| lap_optout_check_api_url1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| cs.xiht.plus/ | Name: PHPSESSID Value: 9npcve9af5dvbcv0riie89rpn7 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cs.xiht.plus
160.20.59.33
1aa29eb304bddce08e60f5de334ad7307b65ddd121e360ca1bebcedeecd5bda3
33d8a2ac1557580cf6b60f833be3d06ebab915f787840b89eda95adc19751be7
78de89876929c54e42832411a12483264c4b65ef2a0ed7e666caa0f72a2a0019
847d75b96b7fbb7a0495dcd04d2b1185bf598f5bcbeb37b130c114845b467d69
8f373e088bf0247e483b1b5ecc3a9668a3aed14bdf7e8b3423a130523864436b
8f3c131717953ff7ad807f587dfcec4b56663fba12c533ba913ea3b0fa35ce92
df060161a50635edf41b7c67193d5c101c1a19dfb7cd7ed4dd948128937afe63
e567f11657461ac1c42ecf2e1baf73f3e2fe4623d75c3031292e053b1b32248c